(For those not au fait with the late, great Douglas Adams and “The Hitchhiker’s Guide to the Galaxy,” the above title is a reference to that awesome tome.)

Over the last couple of years, I’m really proud of what we’ve achieved at CloudU. When I first approached Rackspace with the idea of a vendor neutral cloud education series and certificate, I was stoked to get some awesome buy-in at all levels of the organization. In particular the awesome Michael Ferranti did an amazing job of balancing the different imperatives, proofing my sometimes less than stellar copy and generally keeping things on track.

Since then we’ve produced over a dozen reports, a bunch of really cool videos, dozens of blog posts and have spoken at a myriad of events. Over 10,000 people have gained the CloduU certificate and we’ve even had some awesome feedback about people getting jobs upon completion of CloudU.

But all good things must come to an end and Rackspace will move CloudU in-house for 2013.

So I’ll be moving on from CloudU, I’m super proud of the program and look forward to seeing Rackspace take it to the next level. I’m keen to remain in touch with the CloudU community – don’t be shy to look me up on the Twitters!

Ciao!

People go to great lengths to explain how cloud computing is democratizing IT and enabling the end-users of technology to make some decisions themselves about what they use, how they use it and how quickly they can get set up. A plethora of enterprise vendors have got their start in life, and built their momentum, by providing this vector for so called “rogue IT.” Companies like Yammer, Box and even Salesforce in its early days all took advantage of the real frustration felt by business units that simply wanted to achieve an outcome and felt blocked at every turn by enterprise IT that isn’t exactly known for being flexible and proactive when it comes to rolling out new stuff.

Of course this sort of rogue IT isn’t ideal – it means that a huge number of different solutions are in use within the organization; that costs can spiral out of control; and that no due-diligence has occurred as to the security, reliability and robustness of the solutions being used. But what is a business to do? Historically, getting servers deployed takes weeks because of interminable processes. Software evaluations may take a few days from the business end but then get bogged down in weeks of security and compliance checks by IT. It doesn’t meet the needs of the business that every day is being pressured to do more, for less.

But let’s look at it from IT’s perspective for a moment. IT is tasked with ensuring that all the various pieces of technology within an organization work within some security constraints. They’re responsible for ensuring that data, the most valuable thing an organization has, stays in its rightful place, and finally they’re busy making sure the organization gets the best bang for its buck – having dozens of individual business units sign up for different cloud services is, in their mind at least, risky, expensive and tantamount to an invitation to data loss.

Perhaps the time has come to not look at this as such a binary conversation – after all these two groups, IT and the business, aren’t exactly at war. IT wants to enable the business to meet its objectives. True it can sometimes be a little abrasive in its approach (hey, IT staff tend to be generalized as not having a high degree of social skills after all) but fundamentally it aims to deliver the solutions the business needs, to help the business achieve its strategic outcomes and all the while deliver these solutions in a way that doesn’t put the business at risk. IT is about safety first, and delivery second.

The business shares many of these objectives. After all no business unit wants to do anything that puts the organization at risk, they don’t want to introduce a vector for data loss, nor do they want to increase the cost burden on their organization. What they do want to do is achieve their business aims as quickly and easily as possible. If we had to characterize them as a class, we’d say that the business unit is all about delivery first, and safety second.

Building A Bridge

So how would it look if we took these two groups – IT with its security first and delivery second approach, and the business unit, with its delivery first and security second approach — and gave them solutions that allowed both of them to meet their objectives, but in a way that also delivered the priority seen as most important to the group on the other side of the chasm. In other words, how do we enable IT to deliver solutions in an agile manner, happy in the knowledge that they are inherently secure? And how do we enable the business to choose inherently secure solutions, happy in the knowledge that they’ll be delivered in an agile way?

Of course the industry is partially to blame for the existence of this chasm between the two groups. Traditional vendors, those selling directly to IT, have been quick to articulate at great length and in no uncertain terms just how much of a threat this new generation of cloud tools poses to the organization. The traditional diet of fear, uncertainty and doubt has consisted of a million and one thinly veiled messages telling enterprises that by enabling business unit self-provisioning they open themselves up to mass risk.

And the new breed of vendors has also had some guilt to shoulder. Rather than encourage a positive relationship between IT and the business, they have been quick to pour scorn on IT’s very ability to deliver and its awareness of how social, mobile and cloud are fundamentally changing the business’ needs . These new vendors, in an effort to encourage the very rogue IT that corporate IT is worried about, have presented a black and white choice where businesses have little option but to acquire solutions by subterfuge in order to achieve their aims.

A Third Way

There is, however, light at the end of the tunnel. A new generation of vendors are coming on line that realize that in order to build viable and sustainable businesses they need to find a message and a delivery mechanism that allows both sides of the debate – IT and the business – to achieve their objectives without undermining the objectives of the other side. These vendors realize that business self-service can happen in a way that is sympathetic to IT’s need for governance, security, visibility over cost and integration with legacy systems. These vendors understand that IT-centric tools can also be built in such a way as to enable the business to gain a degree of autonomy over their day to day operations.

Some good examples exist – companies like enStratus are allowing enterprise IT to deliver their businesses a self-service portal to manage their cloud infrastructure. This is done with the buy-in and approval of IT, which is happy that its important requirements around governance and control are maintained. Cloudability is helping enterprises gain insight into their overall cloud spend so that the financial and budgetary requirements of the organization can be met without reducing business units’ ability to self-determine. And here at Appsecute we’re creating a bridge whereby individual developers and teams of developers have the autonomy to use the tools that best suit their particular objectives, but to do so in a way that gives central IT visibility and audit control over what they’re doing.

The future has to be one in which the massive tensions that exist between IT and the business unit are resolved – companies that find ways to meet the needs of both sides of the divide help to move the discussion from one of risks, problems and barriers to one of rewards, benefits and outcomes.

When travel and talk to companies about the cloud, one of the common questions I get is about how to choose which applications to move to the cloud – once you’ve sold people on the benefits that cloud brings (agility, flexibility, scaling, economics), the next question is generally “cool, so how do we do it?”

It’s actually a pretty complex question. Moving to the cloud isn’t simply a case of rip and replace. Over on the Forrester blog, Vice President and Principal Analyst James Staten recently wrote a great post that dispelled some of the common cloud myths, at least when it comes to moving applications to the cloud. Staten focused on the fact that, in the same way that cloud is very different to a traditional hosted environment, so too is it wrong to think you can put any old app straight into the cloud and expect “cloud-like” performance. As he said:

…you shouldn’t be thinking about what applications you can migrate to the cloud. That isn’t the path to lower costs and greater flexibility. Instead, you should be thinking about how your company can best leverage cloud platforms to enable new capabilities. Then create those new capabilities as enhancements to your existing applications… you have to think differently as you approach cloud development. There’s far more power in application design and configuration once you free yourself from assumed reliance on the infrastructure. The end result is new degrees of freedom for developers – if you embrace the new model

All valid points. Another way to look at this cloud application problem is to use the metaphor of peeling an onion (bear with me on this).

This is an analogy I often use in distinct ways to talk about moving workloads to the cloud.

From the vanilla to the hyper-differentiated, think of your organization’s different applications as being like an onion with the inner layers being highly-differentiated applications, which are a true core-competency for the business. As you go out further, the applications become more and more generic and hence similar between your organization and your competitors. At the very outside of the onion is the “vanilla apps,” those that are standard across all organizations – the typical example being email or office productivity. When thinking about a staged move to the cloud, approach your applications working from the outside in. As you become used to the way cloud works, and the opportunities and challenges it brings for your organization, you’ll be more ready for more complex and differentiated applications.

The other way I use the onion metaphor is to talk about organization porosity and outside involvement. At the very inside of the onion are those applications that only get exposed within the organization itself, and possibly only within one or two offices within the organization. As you go out further, the outer layers have much more need to interact with other parts of the organization (perhaps branch offices or whatever). On the outside are applications that have significant interplay between the organization and the outside world (be it suppliers or customers). Clearly the outer layers have much more validity as initial cloud projects; partly because there should be less security risk with these applications, but also because the agility and integration requirements of these applications makes them good candidates for cloud deployment

I don’t preach an “all or nothing” cloud approach. Cloud is a sliding wedge and existing organizations should look at taking baby steps and slowly increase the breadth and depth of their cloud usage.

As we all use more and more different services and applications in our personal and work lives, password management becomes ever more of an issue. It’s staggering the number of times I’ve had to gently make people aware of the fact that using one simple password for every single service they use probably isn’t the best idea. To be honest, it wasn’t that long ago that laziness and an unwillingness to spend a little more time when signing up (and thereafter when signing in) to services meant that I too had a poor approach towards password security.

A couple of years ago I finally realized that with several hundred different services in my proverbial quiver, and given my propensity to sign up to every single new site I find, that a more robust approach towards password management was required. In my case I started using, and became a massive fan of, LastPass, an amazing service I’ve written about before that not only remembers all your passwords, but has handy features like automated form-filling and password generation – the idea being that users have one master password and that unlocks LastPass and hence access to all other passwords.

I’ve always had a concern at the back of my mind though that this approach wasn’t really safe – what happens if LastPass got hacked? What if, during my frequent travels, someone used key-logging software to learn the password and then gained access to all my other services? What if I get run over a bus and incapacitated and my passwords, and hence online services, all become inaccessible?

I was pretty relieved then to read a post by Mark O’Hare, CIO at email management vendor Mimecast, in which he talks about password security and tells of his own use of LastPass. I figure if a risk averse CIO uses the product, it must be safe for mere mortals too. O’Hare gives some advice for using a password manager (PM) effectively:

Protect your PM with a single secure complex password, one that is easy to remember but hard to guess. My suggestion is 12+ characters, not based on a dictionary word and a mix of upper, lower, numerals and special characters. If your PM supports it, use 2-factor authentication. Google Authenticator is a free, time-based one-time Password generator and some PMs integrate with it. Use your PM’s built in password generator to generate long and complex passwords which will be stored securely in your PM. Go to each site or service you use and change the password to something unique using your PM’s built in password generator.

It feels like we’re reaching a tipping point however – there has been lots of attention given recently to the fact that using two-factor authentication is a sensible choice. Free products like Google Authenticator help make online service use more secure. The other angle that helps in this regard is the rising use of authentication tools like OAuth and SAML, which both help users to authenticate third party sites using one trusted identity provider – in the consumer space Facebook and Google have both proved popular as identity hubs.

As increased use of online tools makes it ever more attractive for people to gain access to others’ accounts, robust approaches towards authentication and security become all the more important. Password management and third party authentication are two important safeguards in this journey.

One of the reasons for setting up the CloudU program and certificate was a desire to scale the one-on-one work I do helping small and large businesses and the people that work within them understand what the cloud actually is. This is made all the more necessary because of the messages these people get from different technology vendors – those who claim cloud is a solution for all the world’s ills, and those who claim cloud is just the same technology we’ve had before, but with a fancy new label on it.

I’ve long said that I believe cloud is revolutionary – primarily because it melds technical innovations (virtualization, the web, APIs, etc.) with new ways of doing business (a utility model, subscription basis, ease of use). Put these two things together and you have a revolution.

To help get this message across I filmed some video recently and had it animated to punch the message home – enjoy 2:36 of a justification for why cloud is indeed a revolution.

Recently, I moderated a CloudU roundtable that continued an ongoing theme of mine –overcoming the hurdles to greater cloud adoption. In this case we looked deeply at the cloud cost area. This is a really important problem space to resolve.

You see, depending on your perspective, the fact that cloud computing means that technology is democratized and available to all is either the best thing ever, or the worst thing ever. For business units it’s great – it gives them the ability to acquire technology without going through the often long and torturous process with IT. For IT and CFOs, however, technology democratization is painful – it means they lose control and visibility over what people are using and what costs are being incurred by the company. That can result in some big surprises at the end of the month, quarter or financial year.

It was awesome then to talk with Tyler Sloat, CEO of subscription and billing vendor Zuora, and Mat Ellis, CEO of cloud spend management company Cloudability (disclosure, I’m an investor in Cloudability) to get their perspectives on this cloud cost conundrum.

We started off by setting a little bit of context: I detailed exactly why I believe the cloud is a revolution rather than an evolutionary step for technology, and why the democratization that cloud produces is both a positive and a problematic thing for organizations. We talked about the balance that organizations strive to find between control (for IT, the CFO and the C-suite generally) and agility.

Some questions we talked about included:

• Why is cloud cost so complex?
• What is the CFO perspective on how you think about this problem?

Finally, we talked about specific ideas for solving the problem – Mat Ellis set out a four-step cycle of continuous improvement when it comes to managing cloud cost issues:

1. Tell finance to categorize cloud expenditure in a special place to keep an eye on it.
2. Obtain a cloud cost management solution to avoid any surprises.
3. Review costs. Ask questions (Can we do more with less?). Optimize.
4. Hold people accountable for their spending.

It was an interesting discussion that revolved around an important, but often ignored, issue. You can check out the replay below.

One of the most interesting areas in the conceptual discussion of the cloud is the economic impacts it can bring. The conversation is so much broader than just cost savings; there is a deep and complex series of discrete topics to look at relating to both costs and ROI relating to cloud. One of the CloudU chapters looks specifically at the topic of the economics of cloud. This chapter was influenced heavily by the undisputed leader in the field, Joe Weinman. Not only did Weinman coin the general term used to describe the topic-area, “Cloudonomics,” but he also recently published the definitive guide to the topic “Cloudonomics: The Business Value of Cloud Computing.”

Weinman is an intellectual who brings a scholarly approach to the work – in the books 350-plus pages, he runs through a huge amount of data, case studies, economic analogues and theoretical concepts that all back up his assertions. Weinman does an excellent job of capturing all the different subject areas remotely related to Cloudonomics – he goes from a clarification of what cloud is and how it comes about to deployment strategies, scaling factors, demand forecasting, performance aspects alongside the culture impacts and aspects of a move to the cloud. It really is the definitive tome – a reference guide that, despite being focused on an area of rapid and massive change, will be the go-to publication for years to come.

One of the really compelling aspects is the number of case studies and analogies from unrelated industries that Weinman uses to illustrate the concepts he espouses. He does so without presuppositions – Weinman himself is a cloud believer and part of the tight-knit Clouderati group, but that doesn’t color his writing, rather the determinations he comes to are worked through from actuality as opposed to some dogmatic “cloud is the answer to all problems” mindset.

The book is a useful publication for a vast variety of people. Technical folks will like its thorough analysis; anyone in the C-suite will enjoy its robust business-logic; and the vendor side will find lots of useful content that they can use to justify one or another of their products or services. It is also useful to an entire new generation of technology and business people who will be expected to work with and on the cloud – my 12-year-old son is (strange as it may sound) interested in cloud computing and he’s slowly working through the book as the picture shows. If a 350-page manifesto full of deep economic theories can hold the attention of a 12-year-old, that is a sure indication that Weinman has done an excellent job creating a compelling and eminently useful book.

Recently at Box’s BoxWorks event, I had the good fortune to hear Clayton Christensen, author of such seminal innovation books as “The Innovator’s Dilemma,” present about disruption in technology generally. Anyone remotely involved in plotting strategy for either existing or new companies needs to read Christensen’s work. Anyway, around the same time Geoffrey Moore, author of yet another seminal business book, “Crossing the Chasm,” wrote an article in which he attempted to dissect cloud computing according to what he says is the adoption rate of different cloud applications. It’s always interesting to see brilliant and well-respected business commentators try and take their general theories and apply them to one specific area – oftentimes they come a little unstuck. The key mistake Moore makes is separating all these different parts of cloud, and not seeing the underlying trend, the fact that Cloud (notice the capital “C”), is disruptive en large.

Luckily the cloud world has its own caped crusader in the form of Cloudscaling founder Randy Bias, who came out with a well-reasoned post responding to Moore’s assertions. Bias points out, in no uncertain terms, that the error Moore made was in looking at cloud computing purely as an outsourcing model – true there are aspects of outsourcing with cloud – but there are far bigger disruptive forces involved here than simply that. As Bias points out:

Cloud Computing is *not* outsourcing. It’s a new, paradigm shift in the IT computing model akin to the transition from “mainframe computing” (aka “big iron”) to “enterprise computing” (aka “client/server”).

It is a paradigm shift that goes beyond discrete aspects of technology and instead has a massive effect on all parts of the technology “stack.” Bias helpfully provides a diagram to put this shift in context with the previous shifts that IT has witnessed – the emergence of mainframe computing, the client server era and now cloud.

Bias goes on to talk about industry trends which fall nicely in line with Christensen’s theories about disruptive forces: the struggle the existing players face, the adoption of cloud by existing customers, the new generation of applications that this disruption enables and the new revenue streams and models that are emerging.

Finally, Bias makes some big, bold predictions as to what the next couple of decades will look like in the technology industry:

…we are in the grip of a manifest disruption. It cannot end until some other new prevalent model displaces cloud computing. And if time prior timeframes are any judge, that means 2030 at the earliest.

Sometimes we need to take a step back, lose focus on minutiae for a minute and look at the bigger picture that exists. Bias’ post offers some excellent food for thought in setting out the seismic shifts we are currently in the midst of.

A while ago over on GigaOm, Matt McLarty of Layer 7 Technologies wrote an awesome post about the rise of Bring Your Own Device or BYOD.

For those who haven’t spent much time thinking about the term, BYOD describes the new paradigm where individuals within an organization supply their own devices (mobile, laptop, iPad, whatever) that they need to perform their jobs. The theory goes that by following a BYOD approach an organization will spend less on hardware; employees will be more productive since they’re using the gear they want to use; better care will be taken of expensive devices; and overall productivity and efficiency will rise.

Much time has been spent (and rightly so) looking at the security implications of an organization moving from one or two different form factors and operating systems to a paradigm where there could conceivably be a wide variety of device types, sizes, operating systems and software. All of which provides numerous new and frightening vectors of vulnerability. Often, however, the security argument is used as a proxy for an organizations yearning for lock down, for control.

Looking past the security debate, there is a bigger, and more exciting change occurring in the work place; one that points to some realities around the adoption of cloud computing.

Almost 20 years ago I wrote a paper while studying about my vision for the organization of the future. I used the term “organic business” to describe what I foresaw happening – this modern organization would have a small permanent central hub, but beyond that it would make use of a vast array of different individuals with specific skills.  These people would flow in and out of the organization on an ad hoc basis depending on the particular project being worked upon. Think of it like cells in the human body where a local infection (specific project) generates the attention of many different cells and systems in the body (project specific teams). These cells and systems sometimes work directly at the site of the infection, but also work in other areas of the body connected by a complex series of nervous and bio-chemical connections. This complex relationship between local and remote systems, permanent and temporary involved systems and complex communication channels perfectly mimics this modern organization that I prognosticated.

If this is the way the future looks, then how can we possibly expect an organization to control device types? This is fundamentally impossible, as a company will no longer have a hard edge between employees and the outside world. Rather it will have a massive selection of operatives who come and go regularly, but who all need to be kept in contact with their other team members – often times in vastly different time zones, geographies and working paradigms. The future then is about open architectures; the adoption of broad API strategies that allow every possible device to interact with core organization data; and an acceptance that everyone related to an organization will be working in a place, with a method, within a time zone and on a device that differs from those working alongside them.

I’ve been a part of, or at least a witness to, a huge number of battles about what constitutes the “real cloud.” These battles seem to generally be fought on a Sunday afternoon U.S. time – that kind of suits me fine because it means the Monday mornings in my time zone have enough entertainment value to get me up and going.

Beyond the obvious entertainment value however is some pretty serious dogma that goes something like this:

• The public cloud purist’s argument goes something along the lines that only the public cloud can deliver the scale that drives the economies of scale to really make a difference. They also argue that private cloud is just about traditional legacy vendors selling more tin and the software that goes with it isn’t sufficiently robust for real world needs.
• The private cloud aficionados, on the other hand, say that the public cloud is a security nightmare with risks at every turn, it’s more expensive than traditional IT and that it simply isn’t reliable enough to be trusted

Obviously there are other nuances but this is the general thrust of the debate. As I say, it’s entertaining, but it’s ultimately damaging for those who are simply trying to articulate a value proposition that can deliver benefits for organizations.

Given this adversarial status quo, it was refreshing to open my RSS reader last Sunday and see an awesomely pragmatic post on GigaOm by Mark Thiele who, apart from being one of the thought leaders in the cloud, is also vice of data center tech at Switch Networks, the company that operates the seriously impressive SuperNAP in Las Vegas (if you ever get the opportunity be sure to take a tour there – amazing).

In his post, Thiele posited the concept of the “actual cloud.” He advises that when someone asks an organization what sort of cloud they’re using, the stock response should be “who cares?” Rather, people should be looking for achieving outcomes. As he points out:

When you’ve created a cloud oriented organizational model, then the technology that supports it is but an enabler. If you can solve the problem most effectively by cobbling something together yourself with all commodity and opensource then you should. However, if you can reach your objectives more quickly or cost effectively by buying a pre-packaged “cloud” offering or using a global public cloud service, then that’s where you should go.

Beyond fuel for the Sunday afternoon debate club, the technology you chose doesn’t really matter. What does matter is whether or not it’s delivering the speed, agility, efficiency and flexibility that your organization needs – and that’s where the actual cloud comes in.